VulnHub

F5 Networks has reported a serious vulnerability in its BIG-IP Access Policy Manager (APM) that allows attackers to execute arbitrary code on systems without authentication. This flaw, identified as CVE-2026-94127, specifically impacts systems where APM functions as an OAuth authorization server, which is responsible for generating access tokens for applications. F5 disclosed this issue on September 22, 2023, and has since released hotfixes to address the vulnerability. Organizations using affected versions of BIG-IP APM are urged to apply these updates promptly to protect against potential exploitation. The situation is critical as attackers are actively taking advantage of this flaw, posing significant risks to the security of OAuth servers.

A serious vulnerability in F5's BIG-IP application delivery controller has been identified, allowing unauthenticated attackers to send malicious traffic that could lead to remote code execution. This issue poses a significant risk as it can be exploited without authentication, making it easier for attackers to gain control of affected systems. Organizations using BIG-IP products need to act quickly to secure their systems, as this vulnerability is being actively exploited in the wild. F5 has not specified which versions are affected, but the urgency of the situation calls for immediate attention from IT departments to prevent potential breaches. Users should stay updated on patches and security advisories from F5 to mitigate this risk.

F5 Networks has issued urgent security updates to fix a serious vulnerability in its BIG-IP APM (Access Policy Manager) product. This zero-day flaw allows attackers to execute remote code, which means they can potentially take control of affected systems. The vulnerability is actively being exploited in the wild, posing a significant risk to organizations using the software. Users of BIG-IP APM are advised to apply the patches immediately to safeguard their systems. Without these updates, organizations remain vulnerable to exploitation, which could lead to data breaches or unauthorized access to sensitive information.

CISA has updated its Known Exploited Vulnerabilities Catalog by adding four new vulnerabilities that are currently being exploited. These include issues affecting multiple Check Point products related to improper certificate validation and path traversal, an input validation flaw in the Arista VeloCloud Orchestrator, and a heap-based buffer overflow in F5's BIG-IP APM. These vulnerabilities can allow attackers to gain control over affected systems, posing serious risks, particularly to federal agencies. Under a new directive, federal agencies are urged to prioritize fixing these high-risk vulnerabilities, but CISA also encourages all organizations to adopt similar vulnerability management practices. If anyone is aware of additional exploited vulnerabilities not listed, CISA invites them to submit nominations for consideration.

Last week, a Linux rootkit was discovered on F5 BIG-IP APM devices, raising significant security concerns for organizations relying on this technology. The rootkit allows attackers to gain unauthorized access and control over affected systems, potentially leading to data breaches or further attacks. Additionally, vulnerabilities in Cisco's FMC (Firepower Management Center) were actively exploited, putting users at risk of unauthorized access and manipulation of security policies. These incidents highlight the need for organizations to ensure their devices are updated and secured against such threats. Companies should prioritize patching and monitoring their systems to mitigate these risks.

A recent analysis by Sophos has revealed a malware strain that targets F5 BIG-IP Access Policy Manager appliances. This malware is particularly stealthy, as it injects a PHP web shell into the memory of the appliance rather than writing it to disk, making it invisible to traditional file-based security scans. The malware activates when Apache loads specific PHP scripts associated with the appliances, allowing attackers to maintain control without leaving obvious traces. This incident raises concerns for organizations using these appliances, as it highlights the need for enhanced monitoring of memory and runtime behavior in addition to standard disk checks. Companies should review their security measures to protect against this type of attack.

Hackers have successfully breached F5 BIG-IP APM devices, deploying a Linux rootkit that can intercept PHP file loading. This rootkit is particularly concerning because it can inject a fileless web shell directly into the device's memory, which means it doesn't leave malicious code on the disk, making detection more challenging. Organizations using F5 BIG-IP APM solutions could be at risk, as the attackers can exploit these vulnerabilities to gain unauthorized access. This situation emphasizes the need for heightened security measures and vigilance among companies that rely on these devices to protect sensitive data. Users should be aware of the potential for exploitation and take immediate action to secure their systems.

F5 has patched a serious vulnerability in NGINX, identified as CVE-2026-42533, which has a CVSS score of 9.2, indicating it is highly critical. This flaw allows unauthenticated attackers to exploit a heap buffer overflow by sending specially crafted HTTP requests, potentially leading to server crashes or remote code execution. This vulnerability affects NGINX servers widely used for hosting websites and applications, making it a significant concern for organizations relying on this technology. F5's quick response to release patches is crucial to mitigate the risks associated with this vulnerability, as it could lead to severe disruptions or data breaches if left unaddressed.

F5 has released important updates to address a critical vulnerability in NGINX, identified as CVE-2026-42533. This flaw allows attackers to send specially crafted HTTP requests that can cause a heap buffer overflow in the NGINX worker process. As a result, this vulnerability could lead to the crashing or restarting of the worker, effectively denying service to legitimate users. The issue affects versions of NGINX prior to 1.30.4 and 1.31.3, as well as NGINX Plus versions before 37.0.3.1. Users running these versions should upgrade immediately to protect their systems from potential exploitation.

Siemens has identified multiple vulnerabilities in its SINEC OS, particularly affecting the RUGGEDCOM RST2428P product. The issues stem from improper input validation, leading to potential allocation failures that could compromise system operations. Siemens has recommended users upgrade to version 4.0 or later to mitigate these risks. The vulnerabilities have been assigned CVE identifiers, indicating their recognition in the cybersecurity community. This situation is significant as it affects industrial control systems, which are critical for operational integrity and security.

F5 has issued urgent patches for two critical vulnerabilities in NGINX, identified as CVE-2026-42530 and CVE-2026-42055, both rated with a CVSS score of 9.2. These flaws affect the HTTP modules and can be exploited remotely without any authentication, allowing attackers to execute arbitrary code and potentially corrupt memory. This presents a significant risk for organizations using affected NGINX versions, as it could lead to unauthorized access and system compromise. F5's out-of-band updates are crucial for users to secure their systems and prevent potential exploitation. Users are strongly advised to apply these patches promptly to mitigate the risks associated with these vulnerabilities.

F5 has issued patches for serious vulnerabilities found in NGINX, which could be exploited by remote attackers without needing authentication. These flaws could allow attackers to restart the server and potentially execute arbitrary code, raising significant security concerns for organizations using this software. Given that NGINX is widely utilized for web serving and proxying, the risks are substantial for many companies. Users and administrators are strongly advised to apply the patches as soon as possible to safeguard their systems from potential exploitation. This incident serves as a reminder of the importance of keeping software up to date and vigilant against emerging vulnerabilities.

A serious vulnerability has been discovered in F5 NGINX, a widely used web server technology that powers about one-third of all websites globally. This vulnerability is currently being exploited by attackers, raising alarms among cybersecurity experts. The issue poses a significant risk to countless websites and web applications that rely on NGINX for handling web traffic. Organizations using NGINX should take immediate action to assess their systems and implement necessary security measures to protect against potential attacks. The urgency of this situation is underscored by the fact that the vulnerability is actively being targeted in the wild, making prompt remediation essential to prevent data breaches and other malicious activities.

A vulnerability in F5's BIG-IP software, initially categorized as a denial-of-service (DoS) issue, has been reclassified as a remote code execution (RCE) threat. This change comes after new findings revealed that attackers could exploit the flaw to execute arbitrary code on affected systems. Organizations using BIG-IP are at risk, as the vulnerability could allow unauthorized access and control over their systems. The reclassification raises concerns about the potential for severe exploitation, especially since the flaw is reportedly being actively targeted by attackers. Companies using F5 BIG-IP should take immediate action to protect their systems.